Question Re: Encode/Encrypt Fiori/UI5 URL Parameters in Technology Q&A

Encode/Encrypt Fiori/UI5 URL Parameters

adnanmaqbool — Tue, 13 Feb 2024 16:09:22 GMT

Hi Everyone

We are using both standard and custom Fiori Apps, but URL parameters are visible to users e.g. employee number or document number/year. User is able to change the employee number or any other URL parameters to view details of other documents.

For Example

Fiori App Manage Team is having below URL and user is able to change URL parameter "employee number" to view details of other employees. How to encrypt/encode such URL parameters to restrict access to other records and Odata Query Parameters.

https://sapessqas.xxx.com:8000/ess?sap-client=999&sap-language=EN#Employee-manageTeam&/EmployeeDetails/00000146

Note: SSL certificate is already activated may be some profile parameter needs to be maintained from BASIS end to encrypt the URL.

Re: Encode/Encrypt Fiori/UI5 URL Parameters

Edrilan_Berisha — Thu, 15 Feb 2024 00:06:54 GMT

Hi,

well instead of having a "readable ID" like "00000146" as in your example, you could use UUIDs. But that said that is not really an encryption. And to be honest I would highly question what you try to do here.

URL parameter should not be used to define if someone is authorised to see certain data or not. For that kind of purpose you should use proper authorization roles and authorization checks in the backend. That is business logic and belongs to the backend, not the frontend.

Best,

Edrilan Berisha

SAP S/4HANA Cloud Financials Development

Re: Encode/Encrypt Fiori/UI5 URL Parameters

adnanmaqbool — Thu, 15 Feb 2024 10:24:19 GMT

Thanks Edrilan, maybe someone from BASIS end can have some solution.

Re: Encode/Encrypt Fiori/UI5 URL Parameters

Edrilan_Berisha — Wed, 28 Feb 2024 12:00:17 GMT

Hi I am developer myself, so I do not really know what you mean with "BASIS". What you try to do, encrypten the ID to regulate that someone is not easily able to switch is simply not how it should be designed. Nevertheless using UUID is a way as proposed by me.